5 min read<\/p>\n
On 20 August 2026, arrayref 0.3.10 appeared on crates.io, pulling in the proc-macro1 dependency. Its build script downloaded and launched an architecture-specific payload during compilation. The registry removed the version from the index after around 86 minutes; Nextron Systems had reported the incident.<\/strong><\/p>\n Key takeaways<\/p>\n Related:<\/strong> Five metrics the supervisory board actually understands<\/a> \u00b7 Which controls must survive tool consolidation<\/a><\/p>\n The affected release was arrayref 0.3.10. The crate is a lightweight utility library for array references. The malicious logic sat outside this library code and arrived through the newly declared proc-macro1 dependency.<\/p>\n Cargo resolves and builds dependencies from the manifest even when the project’s code does not call them. This explains the incident: an apparently unchanged utility library opened the malicious path once its manifest listed the additional dependency.<\/p>\n In its secondary analysis, SafeDep describes proc-macro1 as a typosquat targeting a family of names associated with procedural macros. RustSec lists the case as RUSTSEC-2026-0260. According to the advisory, there is no patched successor to 0.3.10. It lists versions 0.3.5 to 0.3.9 as unaffected.<\/p>\n According to Rust Security Response, proc-macro1’s build script downloaded and launched an architecture-specific payload during compilation. The attack did not depend on a runtime import in the finished binary. It depended on the build host, network access and the build process’s permissions.<\/p>\n SafeDep’s secondary analysis describes the same sequence: a build dependency, a network download and local artifacts. According to the Rust project, execution took place in the build script.<\/p>\n The investigation identified paths in temporary directories as indicators. On Unix-like systems, \/tmp\/rust-setup appears. On Windows, rust-setup.ps1 and rust-setup-launch.vbs appear in %TEMP%. These paths identify where to investigate. A path alone does not prove infection.<\/p>\n Tenable also catalogs the issue as CVE-2026-77651. The Rust project sources reviewed and the RustSec entry do not mention this number.<\/p>\n Definition · Build script<\/p>\n Cargo runs a dependency’s build script during compilation once the dependency is listed in the manifest. Whether the library code later calls that dependency is irrelevant.<\/p>\n<\/div>\n Rust Security Response names three affected releases: arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9. RustSec separately records append-only-vec 0.1.9 as RUSTSEC-2026-0262. These three names represent compromised releases of established crates.<\/p>\n These are distinct from the deleted malicious dependencies proc-macro1, proc-macro-en, aovine, arone, aronenao and tinymember. Those dependencies served to download and execute malicious code rather than act as legitimate successors.<\/p>\n According to Rust Security Response, the arrayref account’s maintainer likely fell victim to a compromised machine or compromised credentials. The account was suspended as a precaution. This concerns control of the account and does not automatically implicate every downstream project.<\/p>\n A third-party analysis by Wiz describes overlaps with previously observed campaigns; this establishes neither attribution nor widespread infection of Rust projects.<\/p>\n The registry figure measures distribution rather than damage. The current advisory reports 2,285 downloads of arrayref 0.3.10, less than ten percent of total download traffic to date. The figure counts registry fetches. It does not count executed build scripts or prove that everyone who downloaded the crate was compromised.<\/p>\n The lockfile is the first place to check whether a project built the affected version. It records the version actually resolved. The local Cargo cache should also be checked against the same list: arrayref 0.3.10, append-only-vec 0.1.9, internment 0.8.7, plus proc-macro1, proc-macro-en, aovine, arone, aronenao and tinymember.<\/p>\n A cache hit indicates local files without necessarily proving that build logic ran. An arrayref 0.3.10 lockfile entry shows that dependency resolution selected this version. Both findings warrant assessment of the build host.<\/p>\n Cargo inventory checks<\/p>\n The exposure window on crates.io was short. The release was available there for around 86 minutes. The report reached the Rust project on 20 August 2026 at 07:15 UTC. Removal from the index ends public availability; local caches, CI runners and previously generated artifacts remain relevant.<\/p>\n Anyone who built during the relevant window should assess the affected hosts forensically. A build using the listed versions should trigger rotation of credentials, tokens, CI secrets and signing keys under the internal incident process, followed by rebuilding artifacts from a clean environment.<\/p>\n Older versions up to 0.3.9 are listed as unaffected; according to the advisory, there is no patched 0.3.10. Anyone who downloaded the malicious version should revert to a version listed as unaffected while checking the host and secrets.<\/p>\n Sources: Rust Security Response dated 20 August 2026, last updated on 21 August 2026; RustSec RUSTSEC-2026-0260 and RUSTSEC-2026-0262; technical analysis by SafeDep and Wiz.<\/p>\n Each question is locked. Tap to unlock the answer.<\/p>\n RustSec identifies arrayref 0.3.10. The advisory lists the crate as unaffected up to 0.3.9. The local lockfile determines which version was actually built.<\/p>\n<\/details>\n An update alone does not resolve the incident question. The cache, lockfile and build host must be checked together because the malicious logic ran during the build.<\/p>\n<\/details>\n Rust names append-only-vec 0.1.9 and internment 0.8.7, plus the deleted names proc-macro1, proc-macro-en, aovine, arone, aronenao and tinymember.<\/p>\n<\/details>\n The host undergoes forensic assessment. Depending on the findings, credentials, CI secrets and signing keys are rotated, and artifacts are rebuilt from a clean environment.<\/p>\n<\/details>\n No. The registry reports 2,285 downloads of the affected arrayref version. This figure does not count executed malicious scripts or establish that all users were compromised.<\/p>\n<\/details>\n <\/p>\n ▣<\/span><\/span>Editor’s Pick<\/span>Microsoft Teams: Android Path Traversal Runs Attacker Code<\/span><\/span><\/a>▣<\/span><\/span>Editor’s Pick<\/span>What Is a Supply-Chain Attack? Definition and Defense<\/span><\/span><\/a>▣<\/span><\/span>Editor’s Pick<\/span>CI\/CD Published AsyncAPI Botnet Loader<\/span><\/span><\/a><\/p>\n ▣<\/span><\/span>cloudmagazin<\/span>OpenAI Pulls the Plug on Cursor: Your Own Key as Plan B<\/span><\/span><\/a>▣<\/span><\/span>MyBusinessFuture<\/span>Windows 11 limits what AI agents can access<\/span><\/span><\/a>▣<\/span><\/span>Digital Chiefs<\/span>AI Shifts Development into Review Work. Who Owns Sign-off?<\/span><\/span><\/a><\/p>\n Image source: AI-generated (August 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"Rust removes arrayref 0.3.10 after build-time malware: 86 minutes in the index, 2,285 downloads. What lockfiles, Cargo caches and CI must now show.","protected":false},"author":10,"featured_media":23328,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"arrayref malware","_yoast_wpseo_title":"Arrayref: Malware enters the build","_yoast_wpseo_metadesc":"Rust removes arrayref 0.3.10 after build-time malware: 86 minutes in the index, 2,285 downloads. RustSec, lockfiles, Cargo caches and CI as checkpoints.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[263],"tags":[],"class_list":["post-24416","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sicherheitslexikon-en"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":23326,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=24416"}],"version-history":[{"count":7,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24416\/revisions"}],"predecessor-version":[{"id":24991,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24416\/revisions\/24991"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/23328"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=24416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=24416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=24416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
The malicious chain began in the manifest<\/h2>\n
The build became the execution point<\/h2>\n
Three crates, one compromised release process<\/h2>\n
Caches and lockfiles reveal what is present<\/h2>\n
\n
The 86-minute window does not close the case<\/h2>\n
Frequently asked questions<\/h2>\n
Which version of arrayref is affected?<\/strong><\/summary>\n
Is updating the project itself enough?<\/strong><\/summary>\n
Which other crates should we check?<\/strong><\/summary>\n
What should we do about an affected build host?<\/strong><\/summary>\n
Is there evidence of a widespread attack on all Rust projects?<\/strong><\/summary>\n
Editor’s Picks<\/h3>\n
More from the MBF Media Network<\/h3>\n